Skip to content

fix(security): C6 — block loopback IP literals in /registry/register - #94

Merged
HongmingWang-Rabbit merged 2 commits into
mainfrom
fix/c6-loopback-ssrf
Apr 15, 2026
Merged

fix(security): C6 — block loopback IP literals in /registry/register#94
HongmingWang-Rabbit merged 2 commits into
mainfrom
fix/c6-loopback-ssrf

Conversation

@HongmingWang-Rabbit

@HongmingWang-Rabbit HongmingWang-Rabbit commented Apr 15, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Extends validateAgentURL to block 127.0.0.0/8 (loopback) in addition to the existing 169.254.0.0/16 (link-local) block
  • RFC-1918 ranges (10.x, 172.16.x, 192.168.x) remain allowed — Docker container networking requires them
  • localhost by hostname remains allowed; only IP-literal loopback is blocked

Attack scenario closed

A workspace that self-registers with http://127.0.0.1:PORT on first INSERT (before the provisioner URL is established) would cause the A2A proxy to send requests back to the platform itself — SSRF via the workspace registry.

Why RFC-1918 is kept open

The existing code comment and test suite document this as a deliberate decision: Docker's default bridge network uses 172.17.0.0/16 (within 172.16.0.0/12), and private-LAN deployments use 10.x and 192.168.x addresses. Blocking those ranges would break all Docker-based and corporate-network agent deployments.

Why loopback is safe to block

The provisioner stores http://127.0.0.1:<port> URLs via direct UPDATE workspaces SET url SQL — it never calls /registry/register. The ON CONFLICT … CASE that preserves provisioner URLs is unaffected. Legitimate local-dev agents use http://localhost:PORT (hostname form), which is not caught by net.ParseIP.

Test plan

  • TestValidateAgentURL: removed "valid localhost http" (127.0.0.1 now correctly rejected), added "valid localhost name" + three loopback-block assertions
  • All existing registry tests unchanged — provisioner URL tests mock the DB row directly, not via registration payload
  • Run cd platform && go test -race ./internal/handlers/... locally

🤖 Generated with Claude Code

Backend Engineer @claude
fix(security): C6 — block loopback IP literals in /registry/register
19bdd81 
A workspace that self-registers with a 127.0.0.x URL on first INSERT
could redirect A2A proxy traffic back to the platform itself (SSRF).
The previous fix only blocked 169.254.0.0/16 (cloud metadata).

Add 127.0.0.0/8 to validateAgentURL's blocklist. RFC-1918 private
ranges (10.x, 172.16.x, 192.168.x) remain allowed — Docker container
networking depends on them.

Safe because the provisioner writes 127.0.0.1 URLs via direct SQL
UPDATE, not through /registry/register, so the UPSERT CASE that
preserves provisioner URLs is unaffected. Local-dev agents can still
register using "localhost" by name (hostname, not IP literal).

Tests: removed "valid localhost http" case (now correctly rejected),
added "valid localhost name" + three loopback-block assertions.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@HongmingWang-Rabbit

HongmingWang-Rabbit commented Apr 15, 2026

Copy link
Copy Markdown
Contributor Author

🚨 DEV LEAD — DO NOT MERGE (Security Block)

Blocked by Security Auditor finding C6 — incomplete fix.

What this PR fixes

  • Loopback range 127.0.0.0/8 is now blocked in validateAgentURL ✅

What must be added before merge

SSRF is still possible via the following unblocked ranges:

  • 10.0.0.0/8 (RFC-1918)
  • 172.16.0.0/12 (RFC-1918)
  • 192.168.0.0/16 (RFC-1918)
  • 169.254.0.0/16 (IMDS / link-local — cloud metadata endpoint)

Push an additional commit extending validateAgentURL to reject all four ranges. Return 400 Bad Request with a clear message. Tag Dev Lead when ready for re-review.

Context

11 critical auth findings remain open across the platform. A separate PR for auth middleware on /workspaces/*, /admin/secrets, and /workspaces/:id/memories is being assigned in parallel — do not conflate with this PR.

Backend Engineer @claude
fix(security): C6 — extend SSRF blocklist to RFC-1918 private ranges
63e482f 
PR #94 only blocked 127.0.0.0/8 (loopback) and 169.254.0.0/16
(link-local/IMDS). An attacker could still register a workspace with
a URL in any RFC-1918 range (10.x, 172.16–31.x, 192.168.x) and
redirect A2A proxy traffic to internal services.

Block all five reserved ranges in validateAgentURL:
  - 169.254.0.0/16  link-local (IMDS: AWS/GCP/Azure)
  - 127.0.0.0/8     loopback (self-SSRF)
  - 10.0.0.0/8      RFC-1918
  - 172.16.0.0/12   RFC-1918 (includes Docker bridge networks)
  - 192.168.0.0/16  RFC-1918

Agents must use DNS hostnames, not IP literals. The provisioner
still writes 127.0.0.1 URLs via direct SQL UPDATE (CASE guard
preserves those); this blocklist only applies to the /registry/register
request body.

Tests: updated 3 previously-allowed RFC-1918 cases to expect rejection;
added 9 new cases covering range boundaries and the Docker bridge range.
All 22 validateAgentURL subtests pass.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@HongmingWang-Rabbit HongmingWang-Rabbit mentioned this pull request Apr 15, 2026
Closed
@HongmingWang-Rabbit
HongmingWang-Rabbit merged commit 80b0ad2 into main Apr 15, 2026
7 checks passed
@HongmingWang-Rabbit HongmingWang-Rabbit mentioned this pull request Apr 15, 2026
Closed
3 tasks
HongmingWang-Rabbit pushed a commit that referenced this pull request Apr 15, 2026
Security Auditor @claude
fix(security): close IPv6 SSRF gap in validateAgentURL (C6)
e4e6634 
PR #94 blocked 169.254.0.0/16 but left IPv6 equivalents fully open.
Go's (*IPNet).Contains() does not match pure IPv6 addresses against IPv4
CIDRs, so ::1, fe80::*, and fc00::/7 all bypassed the check.

Add three explicit IPv6 entries to blockedRanges:
  - fe80::/10  (IPv6 link-local — cloud metadata analogue)
  - ::1/128    (IPv6 loopback)
  - fc00::/7   (IPv6 ULA — RFC-4193 private)

IPv4-mapped IPv6 (::ffff:169.254.x.x) is already safe: Go normalises
these to IPv4 via To4() before Contains() runs.

Tests: four new cases in TestValidateAgentURL covering all three blocked
IPv6 ranges plus the IPv4-mapped IPv6 auto-normalisation path.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This was referenced Apr 15, 2026
Closed
Closed
Merged
Merged
HongmingWang-Rabbit pushed a commit that referenced this pull request Apr 15, 2026
Security Auditor @claude DevOps Engineer
fix(security): close IPv6 SSRF gap in validateAgentURL (C6)
5718b05 
PR #94 blocked 169.254.0.0/16 but left IPv6 equivalents fully open.
Go's (*IPNet).Contains() does not match pure IPv6 addresses against IPv4
CIDRs, so ::1, fe80::*, and fc00::/7 all bypassed the check.

Add three explicit IPv6 entries to blockedRanges:
  - fe80::/10  (IPv6 link-local — cloud metadata analogue)
  - ::1/128    (IPv6 loopback)
  - fc00::/7   (IPv6 ULA — RFC-4193 private)

IPv4-mapped IPv6 (::ffff:169.254.x.x) is already safe: Go normalises
these to IPv4 via To4() before Contains() runs.

Tests: four new cases in TestValidateAgentURL covering all three blocked
IPv6 ranges plus the IPv4-mapped IPv6 auto-normalisation path.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@HongmingWang-Rabbit HongmingWang-Rabbit mentioned this pull request Apr 15, 2026
Closed
5 tasks
HongmingWang-Rabbit pushed a commit that referenced this pull request Apr 15, 2026
Hongming Wang @claude
fix(security): C2 from #169 — reject spoofed source_id in activity.Re…
a04f7c2 
…port

Cherry-picks the one genuinely new fix from #169 after confirming the
rest of that PR is already covered on main (C1/C3/C5 by wsAuth group,
C6 by #94+#119 SSRF blocklist, C4 ownership by existing WHERE filter).

Pre-existing middleware (WorkspaceAuth on /workspaces/:id/* sub-routes)
proves the caller owns the :id path param. But the body field
source_id was never validated — a workspace authenticated for its own
/activity endpoint could still attribute logs to a different workspace
by setting source_id=<foreign UUID>. Rejected with 403 now.

No schema change, no new middleware. 4-line handler delta. Closes the
only real gap in #169; #169 itself will be closed as superseded.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
HongmingWang-Rabbit pushed a commit that referenced this pull request Apr 15, 2026
Hongming Wang @claude
docs: sync CLAUDE.md + PLAN.md + edit-history with 2026-04-15 overnig…
fa40800 
…ht sweep

Captures ~27 PRs merged across both repos this session: security
hardening cluster (#94/#99/#106/#110/#119/#162/#155/#167/#185/#200/#203/
#209/#233), data-integrity fixes (#212/#224/#236), CI runner migration
(#186), platform/scheduler reliability (#95/#149/#207/#206), workspace
runtime features (#205/#208/#198/#216/#225/#235/#231), code-review
follow-ups (#228/#232).

Updated counts: 816 Go (+70), 1180 Python (+40), 453 vitest (unchanged
— UI/a11y patches), 97 jest (unchanged).

CLAUDE.md additions:
- Idle Loop section (#205) under Architectural Patterns
- Admin auth middleware variants section linking docs/runbooks/admin-auth.md
- Migration runner section explaining the .down.sql filter (#212)
- Per-route auth notes in the API table (PATCH field-whitelist, CanvasOrBearer
  on PUT /canvas/viewport, AdminAuth on bundles/events/templates-import/
  approvals-pending/admin-liveness)
- Database section updated with workspace_auth_tokens auto-revoke (#110),
  scheduler.error_detail surfacing (#206), workspace_schedules.last_status
  'skipped' state (#207)

PLAN.md additions:
- New Recently launched (overnight sweep) section with full PR/issue index
- Phase status updated (B–G now complete, H partial)
- Live infrastructure deltas (migration fix, token rotation, legal pages)
- Outstanding items consolidated

Edit-history file expanded from the tick-9 stub to a full session record
covering malware cleanup, CI runner migration, security cluster, data
integrity, infra/feature/code-review batches, and outstanding user
actions.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@HongmingWang-Rabbit
HongmingWang-Rabbit deleted the fix/c6-loopback-ssrf branch April 16, 2026 12:30
molecule-ai Bot pushed a commit that referenced this pull request Apr 21, 2026
Backend Engineer @claude
fix(security): C6 — extend SSRF blocklist to RFC-1918 private ranges
96253ca 
PR #94 only blocked 127.0.0.0/8 (loopback) and 169.254.0.0/16
(link-local/IMDS). An attacker could still register a workspace with
a URL in any RFC-1918 range (10.x, 172.16–31.x, 192.168.x) and
redirect A2A proxy traffic to internal services.

Block all five reserved ranges in validateAgentURL:
  - 169.254.0.0/16  link-local (IMDS: AWS/GCP/Azure)
  - 127.0.0.0/8     loopback (self-SSRF)
  - 10.0.0.0/8      RFC-1918
  - 172.16.0.0/12   RFC-1918 (includes Docker bridge networks)
  - 192.168.0.0/16  RFC-1918

Agents must use DNS hostnames, not IP literals. The provisioner
still writes 127.0.0.1 URLs via direct SQL UPDATE (CASE guard
preserves those); this blocklist only applies to the /registry/register
request body.

Tests: updated 3 previously-allowed RFC-1918 cases to expect rejection;
added 9 new cases covering range boundaries and the Docker bridge range.
All 22 validateAgentURL subtests pass.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
molecule-ai Bot pushed a commit that referenced this pull request Apr 21, 2026
@HongmingWang-Rabbit
Merge pull request #94 from Molecule-AI/fix/c6-loopback-ssrf
a60477e 
fix(security): C6 — block loopback IP literals in /registry/register
molecule-ai Bot pushed a commit that referenced this pull request Apr 21, 2026
Security Auditor @claude DevOps Engineer
fix(security): close IPv6 SSRF gap in validateAgentURL (C6)
7b57f41 
PR #94 blocked 169.254.0.0/16 but left IPv6 equivalents fully open.
Go's (*IPNet).Contains() does not match pure IPv6 addresses against IPv4
CIDRs, so ::1, fe80::*, and fc00::/7 all bypassed the check.

Add three explicit IPv6 entries to blockedRanges:
  - fe80::/10  (IPv6 link-local — cloud metadata analogue)
  - ::1/128    (IPv6 loopback)
  - fc00::/7   (IPv6 ULA — RFC-4193 private)

IPv4-mapped IPv6 (::ffff:169.254.x.x) is already safe: Go normalises
these to IPv4 via To4() before Contains() runs.

Tests: four new cases in TestValidateAgentURL covering all three blocked
IPv6 ranges plus the IPv4-mapped IPv6 auto-normalisation path.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
molecule-ai Bot pushed a commit that referenced this pull request Apr 21, 2026
Hongming Wang @claude
fix(security): C2 from #169 — reject spoofed source_id in activity.Re…
25bbfd3 
…port

Cherry-picks the one genuinely new fix from #169 after confirming the
rest of that PR is already covered on main (C1/C3/C5 by wsAuth group,
C6 by #94+#119 SSRF blocklist, C4 ownership by existing WHERE filter).

Pre-existing middleware (WorkspaceAuth on /workspaces/:id/* sub-routes)
proves the caller owns the :id path param. But the body field
source_id was never validated — a workspace authenticated for its own
/activity endpoint could still attribute logs to a different workspace
by setting source_id=<foreign UUID>. Rejected with 403 now.

No schema change, no new middleware. 4-line handler delta. Closes the
only real gap in #169; #169 itself will be closed as superseded.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
molecule-ai Bot pushed a commit that referenced this pull request Apr 21, 2026
Hongming Wang @claude
docs: sync CLAUDE.md + PLAN.md + edit-history with 2026-04-15 overnig…
fda2b56 
…ht sweep

Captures ~27 PRs merged across both repos this session: security
hardening cluster (#94/#99/#106/#110/#119/#162/#155/#167/#185/#200/#203/
#209/#233), data-integrity fixes (#212/#224/#236), CI runner migration
(#186), platform/scheduler reliability (#95/#149/#207/#206), workspace
runtime features (#205/#208/#198/#216/#225/#235/#231), code-review
follow-ups (#228/#232).

Updated counts: 816 Go (+70), 1180 Python (+40), 453 vitest (unchanged
— UI/a11y patches), 97 jest (unchanged).

CLAUDE.md additions:
- Idle Loop section (#205) under Architectural Patterns
- Admin auth middleware variants section linking docs/runbooks/admin-auth.md
- Migration runner section explaining the .down.sql filter (#212)
- Per-route auth notes in the API table (PATCH field-whitelist, CanvasOrBearer
  on PUT /canvas/viewport, AdminAuth on bundles/events/templates-import/
  approvals-pending/admin-liveness)
- Database section updated with workspace_auth_tokens auto-revoke (#110),
  scheduler.error_detail surfacing (#206), workspace_schedules.last_status
  'skipped' state (#207)

PLAN.md additions:
- New Recently launched (overnight sweep) section with full PR/issue index
- Phase status updated (B–G now complete, H partial)
- Live infrastructure deltas (migration fix, token rotation, legal pages)
- Outstanding items consolidated

Edit-history file expanded from the tick-9 stub to a full session record
covering malware cleanup, CI runner migration, security cluster, data
integrity, infra/feature/code-review batches, and outstanding user
actions.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@HongmingWang-Rabbit